Threats tagged 'ghsa-phq8-x45p-mjm8'

The Countdown, Coming Soon, Maintenance WordPress plugin versions through 3.0.8 have an authorization bypass vulnerability in one of its AJAX actions. This flaw allows any authenticated user, including low-privileged roles like subscribers, to retrieve the titles of published posts of any post type, even those normally hidden from them. However, draft, private, and pending posts are not disclosed.